Under GDPR, a data controller determines the purposes and means of processing personal data, while a data processor processes data on behalf of the data controller. Both have specific obligations under GDPR. For email marketing, your company is likely the data controller, and your email marketing service provider may act as a data processor.